Best bug bounty skills for Claude Code, Codex and other agents.

Guides smart contract audits and bounty target selection with ten DeFi bug classes, kill signals, a Foundry PoC template and grep patterns.

awarexone/Agentic-Bug-Hunter

Orchestrates a bug bounty session with a 5-phase workflow and a critical-thinking framework covering developer psychology, anomaly detection and What-If experiments.

awarexone/Agentic-Bug-Hunter

Operates the metabigor CLI to map a target's network ranges, subdomains, ports, related domains, CDNs and archived URLs from free sources without API keys.

j3ssie/metabigor

WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorization bypass, payment tampering, information disclosure, logic flaws…

tanweai/wooyun-legacy

Recovers a client-side request signature or anti-bot token just far enough to replay blocked requests in bug bounty testing, starting from a captured packet.

awarexone/Agentic-Bug-Hunter

A selection guide to AI-driven tools for Web3 bug bounty work, from autonomous web pentesters to smart contract bug finders, with notes on authorization.

tradecatlabs/vibe-coding-cn

Adding partial-recon support for a tool: running a single pipeline phase on demand from the workflow graph, reading its inputs from the existing Neo4j graph and merging results back.

samugit83/redamon

Operates Flounder, an autonomous white-hat security auditor.

adshao/flounder

Review FastMCP vulnerability reports before accepting, rejecting, patching, scoring, or publishing them.

PrefectHQ/fastmcp

Runs a bug-bounty engagement through a script that tracks the current pass, builds a board of rows from recon and prints the next required action each turn.

Encod3d-Sec/TORCH

Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments.

elementalsouls/Claude-OSINT

Structure and per-section format reference for a bug bounty report, aligned with YesWeHack's official guidance.

yeswehack/claude-kit

Adaptive web fuzzing for pentests, bug bounty and CTF work: picks the smallest suitable SecLists wordlist per target surface and calibrates filters against soft-404 responses.

Encod3d-Sec/TORCH

移动安全漏洞挖掘知识库，基于HackerOne公开报告提供Android和iOS应用的漏洞挖掘手法、技术细节和代码模式分析；用于安全研究人员和漏洞挖掘者学习参考、代码审计和漏洞检测指导。

s7safe/android-h1

Maps the attack surface of a web domain you are authorized to test: confirms scope, lists subdomains from public sources, probes live hosts and fingerprints technology.

PentesterFlow/agent

HackenProof bug bounty triage workflow for Claude Code plugin marketplace operations.

Gabson0x/bountyforge

Self-validates a bug bounty report draft before submission. An agent skill from yeswehack/claude-kit.

yeswehack/claude-kit

Reference for ten classes of DeFi smart contract bugs, each with root cause, vulnerable code, fix, grep patterns and paid examples, for audits and bug bounty reviews.

tradecatlabs/vibe-coding-cn

Research notes drawn from Trail of Bits, SlowMist, ConsenSys, Immunefi and Cyfrin on smart contract audit methodology, with Slither, Echidna and Medusa setup.

tradecatlabs/vibe-coding-cn

Seven-question triage gate, Immunefi report format and dissected paid bounty examples for deciding whether a smart contract finding is worth submitting.

tradecatlabs/vibe-coding-cn

Worked bug bounty case study of a yield aggregator: target scoring, fund-flow mapping, prior audit triage and a verdict per bug class, with role misconfiguration in focus.

tradecatlabs/vibe-coding-cn

Starting guide for Web3 bug bounty hunts: validating each finding, ten checks per external function, six questions to disprove your own bug, plus recon setup and target scoring.

tradecatlabs/vibe-coding-cn

Records a Web3 bug bounty hunt on ZKsync Era that ended with no findings, using it to show what a hardened protocol looks like and when to drop a target.

tradecatlabs/vibe-coding-cn

Summarize the historical bug patterns for a specific bug bounty program/team using the local disclosed-report corpus.

bugbountywithmarco/bugbounty-disclosed-reports

Spawning and hardening scan containers from the recon orchestrator: the security flags that look correct and break the container, and the sibling bind-mount path handling.

samugit83/redamon

Screens a vulnerability finding with a seven-question gate and pre-submission checks before any report is written, so weak or out-of-scope findings are dropped early.

awarexone/Agentic-Bug-Hunter

A skill your agent uses for ALL authorized offensive-security / bug-bounty work — the single method to find, chain, prove, dedup, and package the highest-value (High/Critical) findings across every…

mtarcure/claude-vibe-squad

Build a hunting checklist / methodology for a vulnerability class or target tech stack, distilled from the local disclosed-report corpus.

bugbountywithmarco/bugbounty-disclosed-reports

Guides writing bug bounty reports for HackerOne, Bugcrowd, Intigriti and Immunefi: impact-first titles, proven claims, CVSS 3.1 scoring and a pre-submit checklist.

awarexone/Agentic-Bug-Hunter

Network reconnaissance workflow using nmap, masscan, and rustscan via NyxStrike tools

CommonHuman-Lab/nyxstrike

Changing or adding a project setting / default value in RedAmon.

samugit83/redamon

Build a high-fidelity network and service inventory using Nmap, Masscan, packet capture, DNS, and protocol-specific follow-up.

cyberful/cyberful

Wiring an LLM into a recon tool's decisions ("let AI pick {feature} for {tool}"): the never-raise contract, the per-target cache, the full+partial coverage, and the two UI toggles bound to one field.

samugit83/redamon

Dependabot and security analysis skill for HASTE. An agent skill from microsoft/haste.

microsoft/haste

A skill your agent uses when publishing, open-sourcing, exporting, sanitizing, or moving code, agent skills, prompts, templates, fixtures, datasets, workshop assets, or other artifacts from a…

serejaris/personal-corp-os

Runs security audits on codebases — full scans, diff reviews, threat models, vulnerability triage, remediation guidance, and finding tracking.

fabricioctelles/skills

Write a disclosure-quality bug bounty report for a finding, matching the HackerOne report format used in this repo's corpus.

bugbountywithmarco/bugbounty-disclosed-reports

Checks that the bb, pt and ctf workflow driver is set up correctly on a machine: vault content, skill symlinks, hooks, imports and a live smoke test, with fixes for failures.

Encod3d-Sec/TORCH

Adding a new tool to the recon pipeline: the enrichment-module contract and its isolated wrapper (the actual fan-out and test call path), graph completeness, and the preset catalog that silently…

samugit83/redamon

Screens vulnerability reports, CVEs and automated findings against seven rules of thumb to accept, dismiss or ask for more information before any deep analysis.

trailofbits/skills

Reference vocabulary for interpreting vulnerability findings — detector-vs-impact distinction, severity anchoring on demonstrated evidence, the eleven-item interpretation rubric, delegation…

provos/ironcurtain

Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis…

awarexone/Agentic-Bug-Hunter

Reference table of per-class false-positive patterns, minimum proof requirements, and impact overclaim traps.

yeswehack/claude-kit

Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.

trailofbits/skills

Web content discovery and technology fingerprinting using gobuster, ffuf, feroxbuster, katana, httpx, and wafw00f

CommonHuman-Lab/nyxstrike

Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi

sickn33/agentic-awesome-skills

Use at the START of any bug bounty hunting session, when switching targets, or when feeling lost about what to do next.

sickn33/agentic-awesome-skills

Complete bug bounty workflow — recon, pre-hunt learning, vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling…

awarexone/Agentic-Bug-Hunter